Russian Intelligence Signal Social Engineering: Detection and Mitigation Guide

---
title: Potential Signal Desktop Installation
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the installation of Signal Desktop on managed endpoints, which may indicate an attempt to bypass email security controls for social engineering.
references:
  - https://www.fbi.gov/news/press-releases
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1199
logsource:
  category: process_creation
  product: windows
detection:
  selection_installer:
    Image|endswith:
      - '\Signal.exe'
      - '\Signal Setup.exe'
    OriginalFileName|contains: 'Signal'
  selection_renamed:
    CommandLine|contains:
      - '--silent'
      - '--install'
    Company|contains: 'Signal Messenger'
  condition: 1 of selection_
falsepositives:
  - Authorized installation by IT staff
level: medium
---
title: Signal Desktop Process Execution
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects the execution of the Signal Desktop application. Frequent execution on non-approved endpoints should be investigated as potential social engineering vector acceptance.
references:
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\AppData\Local\Programs\signal-desktop\Signal.exe'
      - '\Program Files\Signal Desktop\Signal.exe'
    Hashes|contains:
      - 'SHA256=' # Placeholder for specific known bad hashes if available
  condition: selection
falsepositives:
  - Legitimate use of Signal in environments where it is permitted
level: low

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("Signal.exe", "Signal Setup.exe") 
   or ProcessVersionInfoOriginalFilename =~ "Signal.exe" 
   or FolderPath has @"Program Files\Signal Desktop" 
   or FolderPath has @"AppData\Local\Programs\signal-desktop"
| extend AccountCustomEntity = AccountName, HostCustomEntity = DeviceName
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName

-- Hunt for Signal Desktop Installation on Disk
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/AppData/Local/Programs/signal-desktop/Signal.exe')

-- Hunt for Running Signal Processes
SELECT Pid, Name, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ 'Signal.exe'

# Audit and Remove Signal Desktop
# Run as Administrator

Write-Host "[+] Checking for Signal Desktop installation..." -ForegroundColor Cyan

# Define uninstall registry paths
$regPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$signalFound = $false

foreach ($path in $regPaths) {
    $installedApps = Get-ItemProperty $path -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like "*Signal*" }
    
    if ($installedApps) {
        foreach ($app in $installedApps) {
            $signalFound = $true
            Write-Host "[!] Found Signal Application:" -ForegroundColor Yellow
            Write-Host "    Name: $($app.DisplayName)"
            Write-Host "    Version: $($app.DisplayVersion)"
            Write-Host "    Uninstall String: $($app.UninstallString)"
            
            # Attempt Uninstall silently
            if ($app.UninstallString) {
                try {
                    $uninstallCmd = $app.UninstallString -replace '"', ''
                    if (Test-Path $uninstallCmd) {
                        Write-Host "    Attempting to uninstall..." -ForegroundColor Red
                        Start-Process -FilePath $uninstallCmd -Args "--silent" -Wait -NoNewWindow
                        Write-Host "    Uninstall command executed."
                    } else {
                        Write-Host "    Uninstall executable not found at path."
                    }
                } catch {
                    Write-Host "    Error during uninstall: $_"
                }
            }
        }
    }
}

if (-not $signalFound) {
    Write-Host "[+] Signal Desktop not found in registry." -ForegroundColor Green
} else {
    Write-Host "[!] Remediation action taken. Please verify removal." -ForegroundColor Magenta
}